Post #1550840
2026-04-22 01:34 UTC
It is underatandable that there are paths and edge cases that might run into privilege escalation. I understand that this is a highly complex piece of software.
Then not having the possibility to set a capabilities mask for the functionality you certainly do not want/need, is really just a missed opportunity.
Replies (1)
-
@cobratbq@mastodon.social 2026-04-22 02:02
It seems that user-namespaces are always a trade-off of pros and cons, whether you choose to use them, use them only for privileged, or not at all. Granted, I consider specifically the benefits to sandboxing. Still, the matter that it creates an isolation specifically for users and then have syscalls/kernel think it's a general system-namespace privileged call, is just tricky.